A team needs rules targeting groups of application-tier VMs without writing each private IP address into every NSG rule. Which grouping mechanism fits?

1. Management groups
2. Cost Management budgets
3. Availability zones
4. Application security groups